{"id":50714,"date":"2016-06-16T16:35:23","date_gmt":"2016-06-16T23:35:23","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=50714"},"modified":"2025-06-02T20:44:16","modified_gmt":"2025-06-03T03:44:16","slug":"microsofts-june-patch-kills-potential-cfg-bypass","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/","title":{"rendered":"Microsoft\u2019s June Patch Kills Potential CFG Bypass"},"content":{"rendered":"<p>After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The changes are in the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Shader\">Shader<\/a> JIT compiler of the Windows Advanced Rasterization Platform (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Windows_Advanced_Rasterization_Platform\">WARP<\/a>) module (d3d10warp.dll). The Shader JIT compiler could formerly be used to create a CFG bypass. CFG is known to have problems with dynamic code, such as that created by JavaScript JIT and ActionScript JIT compilers. With this update, CFG becomes more robust, and especially more resistant to bypass attacks involving JIT techniques.<\/p>\n<p>WARP is a software-based rasterizer that contains a high-performance <a href=\"https:\/\/msdn.microsoft.com\/en-us\/en-%20us\/library\/windows\/desktop\/gg615082(v=vs.85).aspx#architecture\">JIT code generator<\/a> which can convert High-Level Shader Language byte code to optimized native machine code (SSE, x86\/x64). Moreover, WARP is accessible in the context of the browser by defining Shaders with WebGL (JavaScript-based API), so WARP can be easily employed in browser-based exploit development.<\/p>\n<p>The changes were made in a function that is related to WARP Shader JIT code page protection. This particular fix uses new operating system features\u2014 VirtualAlloc with the \u201cPAGE_TARGETS_INVALID\u201d flag and the SetProcessValidCallTargets API\u2014to make sure only the starting address of a Shader JIT function is the valid call target. (We will demonstrate this later through a live debugging session.)<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/attachment\/20160616-cfg-1\/\" rel=\"attachment wp-att-50718\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50718\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png\" alt=\"20160616 CFG 1\" width=\"968\" height=\"325\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-1.png 968w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-1-300x101.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-1-768x258.png 768w\" sizes=\"auto, (max-width: 968px) 100vw, 968px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/attachment\/20160616-cfg-2\/\" rel=\"attachment wp-att-50717\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50717\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-2.png\" alt=\"20160616 CFG 2\" width=\"947\" height=\"194\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-2.png 947w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-2-300x61.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-2-768x157.png 768w\" sizes=\"auto, (max-width: 947px) 100vw, 947px\" \/><\/a><\/p>\n<p>A look at live debugging before the June Patch (d3d10warp.dll v10.0.10586.0):<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/attachment\/20160616-cfg-3\/\" rel=\"attachment wp-att-50716\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50716\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-3.png\" alt=\"20160616 CFG 3\" width=\"2521\" height=\"1549\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-3.png 2521w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-3-300x184.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-3-768x472.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-3-1024x629.png 1024w\" sizes=\"auto, (max-width: 2521px) 100vw, 2521px\" \/><\/a><\/p>\n<p>Live debugging after the June Patch (d3d10warp.dll v10.0.10586.420):<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/attachment\/20160616-cfg-4\/\" rel=\"attachment wp-att-50715\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50715\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-4.png\" alt=\"20160616 CFG 4\" width=\"2537\" height=\"1473\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-4.png 2537w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-4-300x174.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-4-768x446.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-4-1024x595.png 1024w\" sizes=\"auto, (max-width: 2537px) 100vw, 2537px\" \/><\/a><\/p>\n<p>From the preceding screens, we can clearly see that after applying the June patch most bits on the CFG map corresponding to the Shader JIT code block are cleared except for the first (corresponding to the JIT function entry point), which indicates the function entry is the only valid call target and jumping to any other place will be caught by a CFG check.<\/p>\n<h2>More About Warp Shader JIT Mechanism<\/h2>\n<p>Looking even deeper into the WARP Shader JIT mechanism, we found some other interesting facts:<\/p>\n<ul>\n<li>Unlike with JavaScript\/Flash ActionScript JIT, the data and code for the WARP Shader JIT are stored separately (in their dedicated blocks, respectively), which makes it very difficult to control the generation of arbitrary instructions. However, under certain circumstances a specially crafted Shader can still generate a desired ROP gadget that is good enough to bypass CFG. (In most cases the sequence \u201c\\x94\\xc3\u201d is no longer usable because a CFG check will alter the value in the EAX register.)<\/li>\n<li>Some cautious readers may have noticed that all JIT code blocks appear in some continuous and repeated pattern. That is true; WARP Shader JIT does not take randomization into consideration when allocating code pages and generating instructions. As a result, one can generate a desired instruction at some predictable location (as shown in the preceding screen), which is similar to a <a href=\"https:\/\/en.wikipedia.org\/wiki\/Heap_spraying\">heap-spray<\/a> However, to achieve stable WARP Shader JIT spraying, some obstacles need to be overcome. As of now, this issue has not been fixed (and perhaps never will be). I have verified that this flaw can be leveraged in combination with a certain vulnerability to leak the system module\u2019s address.<\/li>\n<\/ul>\n<p>I plan to write a paper to offer more detail on these aspects. Stay tuned!<\/p>\n<p><em>I would like to thank my colleague Haifei Li for his help in creating this post.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard&#8230;<\/p>\n","protected":false},"author":696,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,32,338],"coauthors":[850],"class_list":["post-50714","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-data-protection","tag-endpoint-protection"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Microsoft\u2019s June Patch Kills Potential CFG Bypass | McAfee Blog<\/title>\n<meta name=\"description\" content=\"After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft\u2019s June Patch Kills Potential CFG Bypass | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-06-16T23:35:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T03:44:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"968\" \/>\n\t<meta property=\"og:image:height\" content=\"325\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Bing Sun\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bing Sun\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/\"},\"author\":{\"name\":\"Bing Sun\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/484eb32a8d246ae6f358b56c01f8b078\"},\"headline\":\"Microsoft\u2019s June Patch Kills Potential CFG Bypass\",\"datePublished\":\"2016-06-16T23:35:23+00:00\",\"dateModified\":\"2025-06-03T03:44:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/\"},\"wordCount\":551,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png\",\"keywords\":[\"computer security\",\"data protection\",\"endpoint protection\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/\",\"name\":\"Microsoft\u2019s June Patch Kills Potential CFG Bypass | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png\",\"datePublished\":\"2016-06-16T23:35:23+00:00\",\"dateModified\":\"2025-06-03T03:44:16+00:00\",\"description\":\"After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Microsoft\u2019s June Patch Kills Potential CFG Bypass\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/484eb32a8d246ae6f358b56c01f8b078\",\"name\":\"Bing Sun\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/717c8b551f131561189868111ca44857\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Bing-sun-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Bing-sun-96x96.jpg\",\"caption\":\"Bing Sun\"},\"description\":\"Bing Sun is a senior security researcher, and now he is leading the IPS security research team of McAfee. He has extensive experiences in operating system kernel and information security technique R&amp;D, with especially deep diving in advanced vulnerability exploitation and detection, Rootkits detection, firmware security and virtualization technology. Moreover, Bing is also a regular speaker at international security conference, such as XCon, Black Hat and CanSecWest.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/bing-sun-064a3372\/\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/bing-sun\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft\u2019s June Patch Kills Potential CFG Bypass | McAfee Blog","description":"After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Microsoft\u2019s June Patch Kills Potential CFG Bypass | McAfee Blog","og_description":"After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-06-16T23:35:23+00:00","article_modified_time":"2025-06-03T03:44:16+00:00","og_image":[{"width":968,"height":325,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/20160616-CFG-1.png","type":"image\/png"}],"author":"Bing Sun","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Bing Sun","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/"},"author":{"name":"Bing Sun","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/484eb32a8d246ae6f358b56c01f8b078"},"headline":"Microsoft\u2019s June Patch Kills Potential CFG Bypass","datePublished":"2016-06-16T23:35:23+00:00","dateModified":"2025-06-03T03:44:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/"},"wordCount":551,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png","keywords":["computer security","data protection","endpoint protection"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/","name":"Microsoft\u2019s June Patch Kills Potential CFG Bypass | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png","datePublished":"2016-06-16T23:35:23+00:00","dateModified":"2025-06-03T03:44:16+00:00","description":"After applying Microsoft\u2019s June patch, we noticed some interesting changes that prevent a security bypass of Windows\u2019 Control Flow Guard (CFG). The","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/20160616-CFG-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/microsofts-june-patch-kills-potential-cfg-bypass\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Microsoft\u2019s June Patch Kills Potential CFG Bypass"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/484eb32a8d246ae6f358b56c01f8b078","name":"Bing Sun","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/717c8b551f131561189868111ca44857","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Bing-sun-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Bing-sun-96x96.jpg","caption":"Bing Sun"},"description":"Bing Sun is a senior security researcher, and now he is leading the IPS security research team of McAfee. He has extensive experiences in operating system kernel and information security technique R&amp;D, with especially deep diving in advanced vulnerability exploitation and detection, Rootkits detection, firmware security and virtualization technology. Moreover, Bing is also a regular speaker at international security conference, such as XCon, Black Hat and CanSecWest.","sameAs":["https:\/\/www.linkedin.com\/in\/bing-sun-064a3372\/"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/bing-sun\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=50714"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50714\/revisions"}],"predecessor-version":[{"id":214978,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50714\/revisions\/214978"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=50714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=50714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=50714"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=50714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}